Which tokens accept one or more of the available operators when building an expression?

An Incident Responder is going to run an indicators of compromise (IOC) search on the endpoints and wants to use operators in the expression. Which tokens accept one or more of the available operators when building an expression?